IN THE CLAIMS ; 



1 . (Currently amended) A method for managing multiple user identities for a user of 
an electronic commerce (e-commerce) site, the method comprising: 

defining the e-commerce site as a plurality of security domains; and 

in response to a user's request to invoke an operation of the e-commerce site: 

identifying a type of user identity being used by the user, wherein the user 
identity is at least one of a guest identity, a generic identity, or a 
registered identity: 
determining if the type of user identity is appropriate to invoke the 
operation; 

responsive to the type of user identity being appropriate to invoke the 
operation, determining a security domain of the plurality of 
security domains to which the operation relates; 

selecting a session fi-om a plurality of sessions persisted for the user based 
on the determined security domain; and 

reusing the selected session for the user automatically in accordance with 
the determined security domain, the selected session being 
associated with a user identity and a role, the user identity and the 
role together indicating privileges for invoking operations of the e- 
commerce site in the determined security domain. 

2. (Previously presented) The method of claim 1 comprising invoking the requested 
operation with the user identity and the role of the selected session. 

3. (Previously presented) The method of claim 2 wherein the selected session 
comprises information indicating at least one of: the user preference's for invoking 
operations at the e-commerce site; the user's preferences for invoking operations at least 
for the determined security domain; and a security signature for authenticating the 
selected session information. 
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4. (Previously presented) The method of claim 1 comprising evaluating the 
requested operation to determine an operation type and wherein the step of reusing is 
performed in accordance with the operation type. 

5. (Canceled) 

6. (Previously presented) The method of claim 4 wherein the user identity is 
associated with an identity type for permitting the invocation of operations; wherein the 
method comprises receiving the user's request in association with the plurality of sessions 
persisted for the user and retrieving the user identity for the determined security domain 
from the plurality of sessions; and wherein the step of reusing is performed in response to 
the identity type of the retrieved user identity. 

7. (Previously presented) The method of claim 1 wherein the step of selecting 
comprises providing one or more cookies defining the selected session to the user for 
associating with a subsequent request. 

8. (Previously presented) The method of claim 7 wherein the cookies comprise an 
authentication cookie and a session cookie; and wherein the method comprises 
authenticating the user's request. 

9. (Previously presented) The method of claim 1 comprising: 

defining each of the plurality of security domains as a hierarchy of organizations 
and assets owned by the organizations; and 

wherein the step of determining the security domain of the plurality of security 
domains to which the operation relates comprises evaluating the user's request in 
accordance with the hierarchy. 

10-27. (Canceled) 
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28. (New) The method of claim 1, further comprising: 

responsive to the type of user identity being an inappropriate type of user identity 
to invoke the operation, 

switching the user to the appropriate type of user identity to invoke the operation. 

29. (New) The method of claim 28, further comprising: 

responsive to the user ending an operation of the e-commerce site, switching the 
user back to the inappropriate type of user identity. 
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